diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index dbca6a3d5e..0db3e1c049 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -319,3 +319,16 @@ Example:: alert tls any any -> any any (msg:"cert chain not value"; \ tls.cert_chain_len:!2; classtype:misc-activity; sid:4; rev:1;) + +tls.alpn +-------- + +Matches on the ALPN buffers. + +Example:: + + alert tls any any -> any any (msg:"TLS ALPN test"; \ + tls.alpn; content:"http/1.1"; sid:1;) + +``tls.alpn`` is a sticky buffer. + diff --git a/src/Makefile.am b/src/Makefile.am index 5b83d60cfd..eb4e4e7205 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -314,6 +314,7 @@ noinst_HEADERS = \ detect-template.h \ detect-template-rust-buffer.h \ detect-threshold.h \ + detect-tls-alpn.h \ detect-tls-cert-fingerprint.h \ detect-tls-cert-issuer.h \ detect-tls-cert-serial.h \ @@ -914,6 +915,7 @@ libsuricata_c_a_SOURCES = \ detect-template-rust-buffer.c \ detect-threshold.c \ detect-tls.c \ + detect-tls-alpn.c \ detect-tls-cert-fingerprint.c \ detect-tls-cert-issuer.c \ detect-tls-certs.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 5d44384858..ada4278a5b 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -59,6 +59,7 @@ #include "detect-tls-cert-issuer.h" #include "detect-tls-cert-subject.h" #include "detect-tls-cert-serial.h" +#include "detect-tls-alpn.h" #include "detect-tls-subjectaltname.h" #include "detect-tls-random.h" #include "detect-tls-ja3-hash.h" @@ -562,6 +563,7 @@ void SigTableSetup(void) DetectTlsCertsRegister(); DetectTlsCertChainLenRegister(); DetectTlsSubjectAltNameRegister(); + DetectTlsAlpnRegister(); DetectTlsRandomRegister(); DetectTlsJa3HashRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 71af4c3a16..f174fea0b6 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -128,6 +128,7 @@ enum DetectKeywordId { DETECT_AL_TLS_FINGERPRINT, DETECT_AL_TLS_STORE, DETECT_AL_TLS_CHAIN_LEN, + DETECT_TLS_ALPN, DETECT_AL_HTTP_COOKIE, DETECT_HTTP_COOKIE, diff --git a/src/detect-tls-alpn.c b/src/detect-tls-alpn.c new file mode 100644 index 0000000000..b4aa82f9c5 --- /dev/null +++ b/src/detect-tls-alpn.c @@ -0,0 +1,148 @@ +/* Copyright (C) 2024 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + * + * Implements support for tls.alpn keyword. + */ + +#include "suricata-common.h" +#include "threads.h" +#include "decode.h" +#include "detect.h" + +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" +#include "detect-engine-content-inspection.h" +#include "detect-content.h" +#include "detect-tls-alpn.h" +#include "detect-engine-uint.h" + +#include "flow.h" +#include "flow-util.h" +#include "flow-var.h" + +#include "util-debug.h" +#include "util-spm.h" +#include "util-print.h" + +#include "stream-tcp.h" + +#include "app-layer.h" +#include "app-layer-ssl.h" +#include "util-profiling.h" + +static int DetectTlsAlpnSetup(DetectEngineCtx *, Signature *, const char *); +static InspectionBuffer *TlsAlpnGetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *f, uint8_t flags, void *txv, int list_id, + uint32_t index); + +static int g_tls_alpn_buffer_id = 0; + +/** + * \brief Registration function for keyword: tls.alpn + */ +void DetectTlsAlpnRegister(void) +{ + sigmatch_table[DETECT_TLS_ALPN].name = "tls.alpn"; + sigmatch_table[DETECT_TLS_ALPN].desc = "sticky buffer to match the TLS ALPN buffer"; + sigmatch_table[DETECT_TLS_ALPN].url = "/rules/tls-keywords.html#tls-alpn"; + sigmatch_table[DETECT_TLS_ALPN].Setup = DetectTlsAlpnSetup; + sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_NOOPT; + sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER; + + DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER, 0, TlsAlpnGetData, 2, + TLS_STATE_IN_PROGRESS); + DetectAppLayerMultiRegister( + "tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0, TlsAlpnGetData, 2, TLS_STATE_CERT_READY); + + DetectBufferTypeSetDescriptionByName("tls.alpn", "TLS APLN"); + + DetectBufferTypeSupportsMultiInstance("tls.alpn"); + + g_tls_alpn_buffer_id = DetectBufferTypeGetByName("tls.alpn"); +} + +/** + * \brief This function setup the tls.alpn sticky buffer keyword + * + * \param de_ctx Pointer to the Detect Engine Context + * \param s Pointer to the Signature to which the keyword belongs + * \param str Should hold an empty string always + * + * \retval 0 On success + * \retval -1 On failure + */ +static int DetectTlsAlpnSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + if (DetectBufferSetActiveList(de_ctx, s, g_tls_alpn_buffer_id) < 0) + return -1; + + if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0) + return -1; + + return 0; +} + +static InspectionBuffer *TlsAlpnGetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *f, uint8_t flags, void *txv, int list_id, + uint32_t idx) +{ + SCEnter(); + InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, idx); + if (buffer == NULL || buffer->initialized) + return buffer; + + const SSLState *ssl_state = (SSLState *)f->alstate; + const SSLStateConnp *connp; + + if (flags & STREAM_TOSERVER) { + connp = &ssl_state->client_connp; + } else { + connp = &ssl_state->server_connp; + } + + if (TAILQ_EMPTY(&connp->alpns)) { + InspectionBufferSetupMultiEmpty(buffer); + return NULL; + } + + SSLAlpns *a; + if (idx == 0) { + a = TAILQ_FIRST(&connp->alpns); + } else { + // TODO optimize ? + a = TAILQ_FIRST(&connp->alpns); + for (uint32_t i = 0; i < idx; i++) { + a = TAILQ_NEXT(a, next); + } + } + if (a == NULL) { + InspectionBufferSetupMultiEmpty(buffer); + return NULL; + } + + InspectionBufferSetupMulti(buffer, transforms, a->alpn, a->size); + buffer->flags = DETECT_CI_FLAGS_SINGLE; + + SCReturnPtr(buffer, "InspectionBuffer"); +} diff --git a/src/detect-tls-alpn.h b/src/detect-tls-alpn.h new file mode 100644 index 0000000000..817b59f38f --- /dev/null +++ b/src/detect-tls-alpn.h @@ -0,0 +1,29 @@ +/* Copyright (C) 2024 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + */ + +#ifndef SURICATA_DETECT_TLS_ALPN_H +#define SURICATA_DETECT_TLS_ALPN_H + +void DetectTlsAlpnRegister(void); + +#endif /* SURICATA_DETECT_TLS_ALPN_H */